Verilay Blog

The Scariest Number in My Security Report Wasn’t the Vulnerability. It Was the File That Was Lying About Them.

I ran my own free tool on my own app and got an F. Fixing the one real vulnerability didn’t explain why the score jumped to a perfect A — the real answer was a file that had quietly stopped telling the truth.

The Part of My Tool That Trusted a Stranger’s Page

My SSRF guard checked the address you typed. It never checked the addresses pulled out of the page that address returned — so the dangerous request never had to pass through the box where anyone types anything.

My Free Tool Had a Limit. It Turned Out the Limit Wasn’t Real.

My AI bill went up, so I went looking. The rate limit had been counting a number visitors write themselves — so it had never limited anything.

The Part of My AI Tool That Shouldn’t Have Been AI

My security tool asked an AI to look for passwords in 25 of your files. Finding a password isn't a judgement call — it's a lookup. What changed when I stopped asking.

The Background Job in Your AI-Built App That Could Delete Every User's Data ↗

The riskiest parts of an AI-built app are often the ones with no screen — background jobs and scheduled tasks. Here's a real one, and how to check yours.

Can You Trust an AI-Built App with Real User Data? ↗

When can you safely go solo with a Lovable or Replit app, and when should you get a second opinion before trusting it with real user data?

3 Ways Non-Developers Can Test AI-Generated Software ↗

Three no-code testing tricks to stress-test your AI-built app before launch: the double-submit test, the malicious-input test, and the mobile audit.

Beyond the Prompt: How to Make Sure Your AI-Built App Actually Works ↗

A jargon-free guide to testing your AI-built app: the 'try to break it' method, what production-ready really means, and when a human second opinion is worth it.

I Built an App with AI… Now What? The 4-Step Checklist Before You Launch ↗

The non-developer checklist before you launch: the fake-identity test, the chaos test, the device reality check, and a launch safety net.

I Ran My Own Security Tool on My Own App — and Got a Different Grade Every Time ↗

My own tool gave my own app a different grade every time. What inconsistent AI scoring taught me — and how I fixed it.

I Built Several AI Apps and Had No Idea If Any of Them Were Secure ↗

The moment I realised my AI-built apps might be vulnerable and what I did about it.

How I Built a Security Tool Without Being a Developer ↗

The technical journey — Flask, Claude API, smart file selection, and the false positive problem.

Why Advise Not Fix Is the Only Safe Approach for Non-Developer Security ↗

Three real conversations that proved the model and what the B grade actually means.

How Evident-AI Went From C to B

Two real vulnerabilities, one false positive, three advice conversations with Replit. Zero broken features.